Lucene search

MitreCVE-2022-24985

HistoryFeb 16, 2022 - 10:15 p.m.

CVE-2022-24985

2022-02-1622:15:08

mitre

web.nvd.nist.gov

cve-2022-24985

jqueryform.com

authentication bypass

remote attack

web security

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.004

Percentile

75.0%

JSON

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server.

Affected configurations

Nvd

Node

jqueryformjqueryformRange<2022-02-05

VendorProductVersionCPE
jqueryformjqueryform*cpe:2.3:a:jqueryform:jqueryform:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
jqueryform	jqueryform	*	cpe:2.3:a:jqueryform:jqueryform::::::::

References

gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560

JQueryForm.com

www.nou-systems.com/cyber-security

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.004

Percentile

75.0%

JSON

Related for CVE-2022-24985